Git-Mirrors/qubes-doc
1
0
Fork 0
mirror of https://github.com/QubesOS/qubes-doc.git synced 2025-09-26 19:40:59 -04:00
Code Issues Projects Releases Packages Wiki Activity

Wrap text and miscellaneous cleanup

Browse source
This commit is contained in:
Andrew David Wong 2021-06-18 06:25:06 -07:00
parent e451f92cde
commit 07c130df00
No known key found for this signature in database
GPG key ID: 8CE137352A019A17
21 changed files with 1845 additions and 1022 deletions
Download patch file Download diff file Expand all files Collapse all files

7
project-security/bulletins-checklist.md
View file

@ -8,7 +8,6 @@ ref: 215
title: Security Bulletin Checklist
---
## Preparation
* Draft QSB and push to private repository
@ -19,6 +18,8 @@ title: Security Bulletin Checklist
* Upload packages to `security-testing` and `current-testing` repositories
* Push QSB to public repository
* Publish a [news post](/news/) using the [QSB Template](/security/bulletins/template/)
* Send the content of the news post to the appropriate [mailing lists](/support/)
* Publish a [news post](/news/) using the [QSB
Template](/security/bulletins/template/)
* Send the content of the news post to the appropriate [mailing
lists](/support/)
* Share link to news post on social media

8
project-security/bulletins.md
View file

@ -12,8 +12,10 @@ ref: 218
title: Qubes Security Bulletins (QSBs)
---
A **Qubes Security Bulletin (QSB)** is a security announcement issued by the [Qubes Security Team](/security/#the-qubes-security-team) through the [Qubes Security Pack](/security/pack/).
A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them.
A **Qubes Security Bulletin (QSB)** is a security announcement issued by the
[Qubes Security Team](/security/#the-qubes-security-team) through the [Qubes
Security Pack](/security/pack/). A QSB typically provides a summary and impact
analysis of one or more recently-discovered software vulnerabilities, including
details about patching to address them.
## Full list

22
project-security/canaries.md
View file

@ -8,13 +8,21 @@ ref: 208
title: Qubes Canaries
---
A **Qubes Canary** is a security announcement periodically issued by the [Qubes
Security Team](/security/#the-qubes-security-team) through the [Qubes Security
Pack](/security/pack/) consisting of several statements to the effect that the
signers of the canary have not been compromised. The idea is that, as long as
signed canaries including such statements continue to be published, all is
well. However, if the canaries should suddenly cease, if one or more signers
begin declining to sign them, or if the included statements change
significantly without plausible explanation, then this may indicate that
something has gone wrong.
A **Qubes Canary** is a security announcement periodically issued by the [Qubes Security Team](/security/#the-qubes-security-team) through the [Qubes Security Pack](/security/pack/) consisting of several statements to the effect that the signers of the canary have not been compromised.
The idea is that, as long as signed canaries including such statements continue to be published, all is well.
However, if the canaries should suddenly cease, if one or more signers begin declining to sign them, or if the included statements change significantly without plausible explanation, then this may indicate that something has gone wrong.
The name originates from the practice in which miners would bring caged canaries into coal mines.
If the level of methane gas in the mine reached a dangerous level, the canary would die, indicating to miners that they should evacuate.
See [Wikipedia: warrant canary](https://en.wikipedia.org/wiki/Warrant_canary) for more information, but bear in mind that Qubes Canaries are not strictly limited to legal warrants.
The name originates from the practice in which miners would bring caged
canaries into coal mines. If the level of methane gas in the mine reached a
dangerous level, the canary would die, indicating to miners that they should
evacuate. See [Wikipedia: warrant
canary](https://en.wikipedia.org/wiki/Warrant_canary) for more information, but
bear in mind that Qubes Canaries are not strictly limited to legal warrants.
## Full list

7
project-security/canary-checklist.md
View file

@ -6,7 +6,6 @@ ref: 216
title: Canary Checklist
---
## Preparation
* Draft canary and push to private repository
@ -15,7 +14,9 @@ title: Canary Checklist
## Announcement
* Push canary to public repository
* Publish a [news post](/news/) using the [Canary Template](/security/canaries/template/)
* Send the content of the news post to the appropriate [mailing lists](/support/)
* Publish a [news post](/news/) using the [Canary
Template](/security/canaries/template/)
* Send the content of the news post to the appropriate [mailing
lists](/support/)
* Share link to news post on social media
* Set a reminder for the next canary

5
project-security/security-pack.md
View file

@ -18,8 +18,8 @@ ref: 213
title: Qubes Security Pack (qubes-secpack)
---
The **Qubes Security Pack** (`qubes-secpack`) is a Git repository that contains:
The **Qubes Security Pack** (`qubes-secpack`) is a Git repository that
contains:
* [Qubes PGP keys](https://keys.qubes-os.org/keys/)
* [Qubes Security Bulletins (QSBs)](/security/bulletins/)
@ -32,7 +32,6 @@ official location is:
<https://github.com/QubesOS/qubes-secpack>
## How to obtain, verify, and read
The following example demonstrates one method of obtaining the `qubes-secpack`,

49
project-security/security.md
View file

@ -16,9 +16,10 @@ ref: 217
title: Qubes OS Project Security Center
---
This page provides a central hub for topics pertaining to the security of the Qubes OS Project.
For topics pertaining to software security *within* Qubes OS, see [Security in Qubes](/doc/#security-in-qubes).
The following is a list of important project security pages:
This page provides a central hub for topics pertaining to the security of the
Qubes OS Project. For topics pertaining to software security *within* Qubes OS,
see [Security in Qubes](/doc/#security-in-qubes). The following is a list of
important project security pages:
- [Qubes Security Pack (`qubes-secpack`)](/security/pack/)
- [Qubes Security Bulletins (QSBs)](/security/bulletins/)
@ -30,27 +31,40 @@ The following is a list of important project security pages:
## Reporting Security Issues in Qubes OS
If you believe you have found a security issue affecting Qubes OS, either directly or indirectly (e.g. the issue affects Xen in a configuration that is used in Qubes OS), then we would be more than happy to hear from you!
We promise to treat any reported issue seriously and, if the investigation confirms that it affects Qubes, to patch it within a reasonable time and release a public [Qubes Security Bulletin](/security/bulletins/) that describes the issue, discusses the potential impact of the vulnerability, references applicable patches or workarounds, and credits the discoverer.
If you believe you have found a security issue affecting Qubes OS, either
directly or indirectly (e.g. the issue affects Xen in a configuration that is
used in Qubes OS), then we would be more than happy to hear from you! We
promise to treat any reported issue seriously and, if the investigation
confirms that it affects Qubes, to patch it within a reasonable time and
release a public [Qubes Security Bulletin](/security/bulletins/) that describes
the issue, discusses the potential impact of the vulnerability, references
applicable patches or workarounds, and credits the discoverer.
## Security Updates
Qubes security updates are obtained by [Updating Qubes OS](/doc/updating-qubes-os/).
Qubes security updates are obtained by [Updating Qubes
OS](/doc/updating-qubes-os/).
## The Qubes Security Team
The Qubes Security Team (QST) is the subset of the [Qubes Team](/team/) that is responsible for ensuring the security of Qubes OS and the Qubes OS Project.
In particular, the QST is responsible for:
The Qubes Security Team (QST) is the subset of the [Qubes Team](/team/) that is
responsible for ensuring the security of Qubes OS and the Qubes OS Project. In
particular, the QST is responsible for:
- Responding to [reported security issues](#reporting-security-issues-in-qubes-os)
- Responding to [reported security
issues](#reporting-security-issues-in-qubes-os)
- Evaluating whether [XSAs](/security/xsa/) affect the security of Qubes OS
- Writing, applying, and/or distributing security patches to fix vulnerabilities in Qubes OS
- Writing, applying, and/or distributing security patches to fix
vulnerabilities in Qubes OS
- Writing, signing, and publishing [Security Bulletins](/security/bulletins/)
- Writing, signing, and publishing [Canaries](/security/canaries/)
- Generating, safeguarding, and using the project's [PGP Keys](https://keys.qubes-os.org/keys/)
- Generating, safeguarding, and using the project's [PGP
Keys](https://keys.qubes-os.org/keys/)
As a security-oriented operating system, the QST is fundamentally important to Qubes, and every Qubes user implicitly trusts the members of the QST by virtue of the actions listed above.
The Qubes Security Team can be contacted via email at the following address:
As a security-oriented operating system, the QST is fundamentally important to
Qubes, and every Qubes user implicitly trusts the members of the QST by virtue
of the actions listed above. The Qubes Security Team can be contacted via email
at the following address:
```
security at qubes-os dot org
@ -58,9 +72,12 @@ security at qubes-os dot org
### Security Team PGP Key
Please use the [Security Team PGP Key](https://keys.qubes-os.org/keys/qubes-os-security-team-key.asc) to encrypt all emails sent to this address.
This key is signed by the [Qubes Master Signing Key](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc).
Please see [Why and How to Verify Signatures](/security/verifying-signatures/) for information about how to verify these keys.
Please use the [Security Team PGP
Key](https://keys.qubes-os.org/keys/qubes-os-security-team-key.asc) to encrypt
all emails sent to this address. This key is signed by the [Qubes Master
Signing Key](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc).
Please see [Why and How to Verify Signatures](/security/verifying-signatures/)
for information about how to verify these keys.
### Members of the Security Team

464
project-security/verifying-signatures.md
View file

@ -11,71 +11,106 @@ ref: 211
title: Verifying Signatures
---
## What Digital Signatures Can and Cannot Prove
Most people --- even programmers --- are confused about the basic concepts underlying digital signatures.
Therefore, most people should read this section, even if it looks trivial at first sight.
Most people --- even programmers --- are confused about the basic concepts
underlying digital signatures. Therefore, most people should read this section,
even if it looks trivial at first sight.
Digital signatures can prove both **authenticity** and **integrity** to a reasonable degree of certainty.
**Authenticity** ensures that a given file was indeed created by the person who signed it (i.e., that it was not forged by a third party).
**Integrity** ensures that the contents of the file have not been tampered with (i.e., that a third party has not undetectably altered its contents *en route*).
Digital signatures can prove both **authenticity** and **integrity** to a
reasonable degree of certainty. **Authenticity** ensures that a given file was
indeed created by the person who signed it (i.e., that it was not forged by a
third party). **Integrity** ensures that the contents of the file have not been
tampered with (i.e., that a third party has not undetectably altered its
contents *en route*).
Digital signatures **cannot** prove any other property, e.g., that the signed file is not malicious.
In fact, there is nothing that could stop someone from signing a malicious program (and it happens from time to time in reality).
Digital signatures **cannot** prove any other property, e.g., that the signed
file is not malicious. In fact, there is nothing that could stop someone from
signing a malicious program (and it happens from time to time in reality).
The point is that we must decide who we will trust (e.g., Linus Torvalds, Microsoft, or the Qubes Project) and assume that if a given file was signed by a trusted party, then it should not be malicious or negligently buggy.
The decision of whether to trust any given party is beyond the scope of digital signatures.
It's more of a sociological and political decision.
The point is that we must decide who we will trust (e.g., Linus Torvalds,
Microsoft, or the Qubes Project) and assume that if a given file was signed by
a trusted party, then it should not be malicious or negligently buggy. The
decision of whether to trust any given party is beyond the scope of digital
signatures. It's more of a sociological and political decision.
Once we make the decision to trust certain parties, digital signatures are useful, because they make it possible for us to limit our trust only to those few parties we choose and not to worry about all the bad things that can happen between us and them, e.g., server compromises (qubes-os.org will surely be compromised one day, so [don't blindly trust the live version of this site](/faq/#should-i-trust-this-website)), dishonest IT staff at the hosting company, dishonest staff at the ISPs, Wi-Fi attacks, etc.
We call this philosophy [Distrusting the Infrastructure](/faq/#what-does-it-mean-to-distrust-the-infrastructure).
Once we make the decision to trust certain parties, digital signatures are
useful, because they make it possible for us to limit our trust only to those
few parties we choose and not to worry about all the bad things that can happen
between us and them, e.g., server compromises (qubes-os.org will surely be
compromised one day, so [don't blindly trust the live version of this
site](/faq/#should-i-trust-this-website)), dishonest IT staff at the hosting
company, dishonest staff at the ISPs, Wi-Fi attacks, etc. We call this
philosophy [Distrusting the
Infrastructure](/faq/#what-does-it-mean-to-distrust-the-infrastructure).
By verifying all the files we download that purport to be authored by a party we've chosen to trust, we eliminate concerns about the bad things discussed above, since we can easily detect whether any files have been tampered with (and subsequently choose to refrain from executing, installing, or opening them).
By verifying all the files we download that purport to be authored by a party
we've chosen to trust, we eliminate concerns about the bad things discussed
above, since we can easily detect whether any files have been tampered with
(and subsequently choose to refrain from executing, installing, or opening
them).
However, for digital signatures to make any sense, we must ensure that the public keys we use for signature verification are indeed the original ones.
Anybody can generate a GPG key pair that purports to belong to "The Qubes Project," but of course only the key pair that we (i.e., the Qubes developers) generated is the legitimate one.
The next section explains how to verify the validity of the Qubes signing keys in the process of verifying a Qubes ISO.
(However, the same general principles apply to all cases in which you may wish to verify a PGP signature, such as [verifying repos](#how-to-verify-qubes-repos), not just verifying ISOs.)
However, for digital signatures to make any sense, we must ensure that the
public keys we use for signature verification are indeed the original ones.
Anybody can generate a GPG key pair that purports to belong to "The Qubes
Project," but of course only the key pair that we (i.e., the Qubes developers)
generated is the legitimate one. The next section explains how to verify the
validity of the Qubes signing keys in the process of verifying a Qubes ISO.
(However, the same general principles apply to all cases in which you may wish
to verify a PGP signature, such as [verifying
repos](#how-to-verify-qubes-repos), not just verifying ISOs.)
## How to Verify Qubes ISO Signatures
This section will guide you through the process of verifying a Qubes ISO by checking its PGP signature.
There are three basic steps in this process:
This section will guide you through the process of verifying a Qubes ISO by
checking its PGP signature. There are three basic steps in this process:
1. [Get the Qubes Master Signing Key and verify its authenticity](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity)
1. [Get the Qubes Master Signing Key and verify its
authenticity](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity)
2. [Get the Release Signing Key](#2-get-the-release-signing-key)
3. [Verify your Qubes ISO](#3-verify-your-qubes-iso)
If you run into any problems, please consult the [Troubleshooting FAQ](#troubleshooting-faq) below.
If you run into any problems, please consult the [Troubleshooting
FAQ](#troubleshooting-faq) below.
### Preparation
Before we begin, you'll need a program that can verify PGP signatures.
Any such program will do, but here are some examples for popular operating systems:
Before we begin, you'll need a program that can verify PGP signatures. Any such
program will do, but here are some examples for popular operating systems:
**Windows:** [Gpg4win](https://gpg4win.org/download.html) ([documentation](https://www.gpg4win.org/documentation.html)).
Use the Windows command line (`cmd.exe`) to enter commands.
**Windows:** [Gpg4win](https://gpg4win.org/download.html)
([documentation](https://www.gpg4win.org/documentation.html)). Use the Windows
command line (`cmd.exe`) to enter commands.
**Mac:** [GPG Suite](https://gpgtools.org/) ([documentation](https://gpgtools.tenderapp.com/kb)).
Open a terminal to enter commands.
**Mac:** [GPG Suite](https://gpgtools.org/)
([documentation](https://gpgtools.tenderapp.com/kb)). Open a terminal to enter
commands.
**Linux:** `gpg2` from your package manager or from [gnupg.org](https://gnupg.org/download/index.html) ([documentation](https://www.gnupg.org/documentation/)).
Open a terminal to enter commands.
**Linux:** `gpg2` from your package manager or from
[gnupg.org](https://gnupg.org/download/index.html)
([documentation](https://www.gnupg.org/documentation/)). Open a terminal to
enter commands.
The commands below will use `gpg2`, but if that doesn't work for you, try `gpg` instead.
If that still doesn't work, please consult the documentation for your specific program (see links above).
The commands below will use `gpg2`, but if that doesn't work for you, try `gpg`
instead. If that still doesn't work, please consult the documentation for your
specific program (see links above).
### 1. Get the Qubes Master Signing Key and verify its authenticity
Every file published by the Qubes Project (ISO, RPM, TGZ files and Git repositories) is digitally signed by one of the developer keys or Release Signing Keys.
Each such key is signed by the [Qubes Master Signing Key](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc) (`0xDDFA1A3E36879494`).
The developer signing keys are set to expire after one year, while the Qubes Master Signing Key and Release Signing Keys have no expiration date.
This Qubes Master Signing Key was generated on and is kept only on a dedicated, air-gapped "vault" machine, and the private portion will (hopefully) never leave this isolated machine.
Every file published by the Qubes Project (ISO, RPM, TGZ files and Git
repositories) is digitally signed by one of the developer keys or Release
Signing Keys. Each such key is signed by the [Qubes Master Signing
Key](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)
(`0xDDFA1A3E36879494`). The developer signing keys are set to expire after one
year, while the Qubes Master Signing Key and Release Signing Keys have no
expiration date. This Qubes Master Signing Key was generated on and is kept
only on a dedicated, air-gapped "vault" machine, and the private portion will
(hopefully) never leave this isolated machine.
There are several ways to get the Qubes Master Signing Key.
- If you have access to an existing Qubes installation, it's available in every VM ([except dom0](https://github.com/QubesOS/qubes-issues/issues/2544)):
- If you have access to an existing Qubes installation, it's available in every
VM ([except dom0](https://github.com/QubesOS/qubes-issues/issues/2544)):
```shell_session
$ gpg2 --import /usr/share/qubes/qubes-master-key.asc
@ -95,33 +130,47 @@ There are several ways to get the Qubes Master Signing Key.
$ gpg2 --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc
```
- Download it as a [file](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc), then import it with GPG:
- Download it as a
[file](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc), then
import it with GPG:
```shell_session
$ gpg2 --import ./qubes-master-signing-key.asc
```
- Get it from a public [keyserver](https://en.wikipedia.org/wiki/Key_server_%28cryptographic%29#Keyserver_examples) (specified on first use with `--keyserver <URI>` along with keyserver options to include key signatures), e.g.:
- Get it from a public
[keyserver](https://en.wikipedia.org/wiki/Key_server_%28cryptographic%29#Keyserver_examples)
(specified on first use with `--keyserver <URI>` along with keyserver options
to include key signatures), e.g.:
```shell_session
$ gpg2 --keyserver-options no-self-sigs-only,no-import-clean --keyserver hkp://pool.sks-keyservers.net:11371 --recv-keys 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494
```
The Qubes Master Signing Key is also available in the [Qubes Security Pack](/security/pack/) and in the archives of the project's [developer](https://groups.google.com/d/msg/qubes-devel/RqR9WPxICwg/kaQwknZPDHkJ) and [user](https://groups.google.com/d/msg/qubes-users/CLnB5uFu_YQ/ZjObBpz0S9UJ) [mailing lists](/support/).
The Qubes Master Signing Key is also available in the [Qubes Security
Pack](/security/pack/) and in the archives of the project's
[developer](https://groups.google.com/d/msg/qubes-devel/RqR9WPxICwg/kaQwknZPDHkJ)
and
[user](https://groups.google.com/d/msg/qubes-users/CLnB5uFu_YQ/ZjObBpz0S9UJ)
[mailing lists](/support/).
Once you have obtained the Qubes Master Signing Key, you must verify that it is authentic rather than a forgery.
Anyone can create a PGP key with the name "Qubes Master Signing Key," so you cannot rely on the name alone.
You also should not rely on any single website, not even over HTTPS.
Once you have obtained the Qubes Master Signing Key, you must verify that it is
authentic rather than a forgery. Anyone can create a PGP key with the name
"Qubes Master Signing Key," so you cannot rely on the name alone. You also
should not rely on any single website, not even over HTTPS.
So, what *should* you do?
One option is to use the PGP [Web of Trust](https://en.wikipedia.org/wiki/Web_of_trust).
In addition, some operating systems include the means to acquire the Qubes Master Signing Key in a secure way.
For example, on Fedora, `dnf install distribution-gpg-keys` will get you the Qubes Master Signing Key along with several other Qubes keys.
On Debian, your keyring may already contain the necessary keys.
So, what *should* you do? One option is to use the PGP [Web of
Trust](https://en.wikipedia.org/wiki/Web_of_trust). In addition, some operating
systems include the means to acquire the Qubes Master Signing Key in a secure
way. For example, on Fedora, `dnf install distribution-gpg-keys` will get you
the Qubes Master Signing Key along with several other Qubes keys. On Debian,
your keyring may already contain the necessary keys.
Another option is to rely on the key's fingerprint.
Every PGP key has a fingerprint that uniquely identifies it among all PGP keys (viewable with `gpg2 --fingerprint <KEY_ID>`).
Therefore, if you know the genuine Qubes Master Signing Key fingerprint, then you always have an easy way to confirm whether any purported copy of it is authentic, simply by comparing the fingerprints.
Another option is to rely on the key's fingerprint. Every PGP key has a
fingerprint that uniquely identifies it among all PGP keys (viewable with `gpg2
--fingerprint <KEY_ID>`). Therefore, if you know the genuine Qubes Master
Signing Key fingerprint, then you always have an easy way to confirm whether
any purported copy of it is authentic, simply by comparing the fingerprints.
For example, here is the Qubes Master Signing Key fingerprint:
@ -131,27 +180,45 @@ pub 4096R/36879494 2010-04-01
uid Qubes Master Signing Key
```
But how do you know that this is the real fingerprint?
After all, [this website could be compromised](/faq/#should-i-trust-this-website), so the fingerprint you see here may not be genuine.
That's why we strongly suggest obtaining the fingerprint from *multiple, independent sources in several different ways*.
But how do you know that this is the real fingerprint? After all, [this website
could be compromised](/faq/#should-i-trust-this-website), so the fingerprint
you see here may not be genuine. That's why we strongly suggest obtaining the
fingerprint from *multiple, independent sources in several different ways*.
Here are some ideas for how to do that:
- Check the fingerprint on various websites (e.g., [mailing lists](https://groups.google.com/g/qubes-devel/c/RqR9WPxICwg/m/kaQwknZPDHkJ), [discussion forums](https://qubes-os.discourse.group/t/there-is-no-way-to-validate-qubes-master-signing-key/1441/9?u=adw), [social](https://twitter.com/rootkovska/status/496976187491876864) [media](https://www.reddit.com/r/Qubes/comments/5bme9n/fingerprint_verification/), [personal websites](https://andrewdavidwong.com/fingerprints.txt)).
- Check the fingerprint on various websites (e.g., [mailing
lists](https://groups.google.com/g/qubes-devel/c/RqR9WPxICwg/m/kaQwknZPDHkJ),
[discussion
forums](https://qubes-os.discourse.group/t/there-is-no-way-to-validate-qubes-master-signing-key/1441/9?u=adw),
[social](https://twitter.com/rootkovska/status/496976187491876864)
[media](https://www.reddit.com/r/Qubes/comments/5bme9n/fingerprint_verification/),
[personal websites](https://andrewdavidwong.com/fingerprints.txt)).
- Check against PDFs, photographs, and videos in which the fingerprint appears
(e.g., [slides from a talk](https://hyperelliptic.org/PSC/slides/psc2015_qubesos.pdf), on a [T-shirt](https://twitter.com/legind/status/813847907858337793/photo/2), or in the [recording of a presentation](https://youtu.be/S0TVw7U3MkE?t=2563)).
- Download old Qubes ISOs from different sources and check the included Qubes Master Signing Key.
- Ask people to post the fingerprint on various mailing lists, forums, and chat rooms.
(e.g., [slides from a
talk](https://hyperelliptic.org/PSC/slides/psc2015_qubesos.pdf), on a
[T-shirt](https://twitter.com/legind/status/813847907858337793/photo/2), or
in the [recording of a presentation](https://youtu.be/S0TVw7U3MkE?t=2563)).
- Download old Qubes ISOs from different sources and check the included Qubes
Master Signing Key.
- Ask people to post the fingerprint on various mailing lists, forums, and chat
rooms.
- Repeat the above over Tor.
- Repeat the above over various VPNs and proxy servers.
- Repeat the above on different networks (work, school, internet cafe, etc.).
- Text, email, call, video chat, snail mail, or meet up with people you know to confirm the fingerprint.
- Text, email, call, video chat, snail mail, or meet up with people you know to
confirm the fingerprint.
- Repeat the above from different computers and devices.
Once you've obtained the fingerprint from enough independent sources in enough different ways that you feel confident that you know the genuine fingerprint, keep it in a safe place.
Every time you need to check whether a key claiming to be the Qubes Master Signing Key is authentic, compare that key's fingerprint to your trusted copy and confirm they match.
Once you've obtained the fingerprint from enough independent sources in enough
different ways that you feel confident that you know the genuine fingerprint,
keep it in a safe place. Every time you need to check whether a key claiming to
be the Qubes Master Signing Key is authentic, compare that key's fingerprint to
your trusted copy and confirm they match.
Now that you've imported the authentic Qubes Master Signing Key, set its trust level to "ultimate" so that it can be used to automatically verify all the keys signed by the Qubes Master Signing Key (in particular, Release Signing Keys).
Now that you've imported the authentic Qubes Master Signing Key, set its trust
level to "ultimate" so that it can be used to automatically verify all the keys
signed by the Qubes Master Signing Key (in particular, Release Signing Keys).
```
$ gpg2 --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494
@ -194,11 +261,16 @@ unless you restart the program.
gpg> q
```
Now, when you import any of the legitimate Qubes developer keys and Release Signing Keys used to sign ISOs, RPMs, TGZs, Git tags, and Git commits, they will already be trusted in virtue of being signed by the Qubes Master Signing Key.
Now, when you import any of the legitimate Qubes developer keys and Release
Signing Keys used to sign ISOs, RPMs, TGZs, Git tags, and Git commits, they
will already be trusted in virtue of being signed by the Qubes Master Signing
Key.
Before proceeding to the next step, make sure the Qubes Master Signing Key is in your keyring with the correct trust level.
(Note: We have already verified the authenticity of the key, so this final check is not about security.
Rather, it's just a sanity check to make sure that we've imported the key into our keyring correctly.)
Before proceeding to the next step, make sure the Qubes Master Signing Key is
in your keyring with the correct trust level. (Note: We have already verified
the authenticity of the key, so this final check is not about security. Rather,
it's just a sanity check to make sure that we've imported the key into our
keyring correctly.)
```
$ gpg2 -k "Qubes Master Signing Key"
@ -207,17 +279,23 @@ pub rsa4096 2010-04-01 [SC]
uid [ultimate] Qubes Master Signing Key
```
If you don't see the Qubes Master Signing Key here with a trust level of "ultimate," go back and follow the instructions in this section carefully.
If you don't see the Qubes Master Signing Key here with a trust level of
"ultimate," go back and follow the instructions in this section carefully.
### 2. Get the Release Signing Key
The filename of the Release Signing Key for your version is usually `qubes-release-X-signing-key.asc`, where `X` is the major version number of your Qubes release.
There are several ways to get the Release Signing Key for your Qubes release.
The filename of the Release Signing Key for your version is usually
`qubes-release-X-signing-key.asc`, where `X` is the major version number of
your Qubes release. There are several ways to get the Release Signing Key for
your Qubes release.
- If you have access to an existing Qubes installation, the release keys are available in dom0 in `/etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-*`.
These can be [copied](/doc/how-to-copy-from-dom0/#copying-from-dom0) into other VMs for further use.
In addition, every other VM contains the release key corresponding to that installation's release in `/etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-*`.
If you wish to use one of these keys, make sure to import it into your keyring, e.g.:
- If you have access to an existing Qubes installation, the release keys are
available in dom0 in `/etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-*`. These can be
[copied](/doc/how-to-copy-from-dom0/#copying-from-dom0) into other VMs for
further use. In addition, every other VM contains the release key
corresponding to that installation's release in
`/etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-*`. If you wish to use one of these keys,
make sure to import it into your keyring, e.g.:
```
$ gpg2 --import /etc/pki/rpm-gpg/RPM-GPG-KEY-qubes-*
@ -229,10 +307,12 @@ There are several ways to get the Release Signing Key for your Qubes release.
$ gpg2 --keyserver-options no-self-sigs-only,no-import-clean --fetch-keys https://keys.qubes-os.org/keys/qubes-release-X-signing-key.asc
```
- Download it as a file.
You can find the Release Signing Key for your Qubes version on the [Downloads](/downloads/) page.
You can also download all the currently used developers' signing keys, Release Signing Keys, and the Qubes Master Signing Key from the [Qubes Security Pack](/security/pack/) and the [Qubes OS Keyserver](https://keys.qubes-os.org/keys/).
Once you've downloaded your Release Signing Key, import it with GPG:
- Download it as a file. You can find the Release Signing Key for your Qubes
version on the [Downloads](/downloads/) page. You can also download all the
currently used developers' signing keys, Release Signing Keys, and the Qubes
Master Signing Key from the [Qubes Security Pack](/security/pack/) and the
[Qubes OS Keyserver](https://keys.qubes-os.org/keys/). Once you've downloaded
your Release Signing Key, import it with GPG:
```shell_session
$ gpg2 --keyserver-options no-self-sigs-only,no-import-clean --import ./qubes-release-X-signing-key.asc
@ -251,13 +331,16 @@ sig! DDFA1A3E36879494 2017-03-08 Qubes Master Signing Key
gpg: 2 good signatures
```
This is just an example, so the output you receive will not look exactly the same.
What matters is the line that shows that this key is signed by the Qubes Master Signing Key with a `sig!` prefix.
This verifies the authenticity of the Release Signing Key.
Note that the `!` flag after the `sig` tag is important because it means that the key signature is valid.
A `sig-` prefix would indicate a bad signature and `sig%` would mean that gpg encountered an error while verifying the signature.
It is not necessary to independently verify the authenticity of the Release Signing Key, since you already verified the authenticity of the Qubes Master Signing Key.
Before proceeding to the next step, make sure the Release Signing Key is in your keyring:
This is just an example, so the output you receive will not look exactly the
same. What matters is the line that shows that this key is signed by the Qubes
Master Signing Key with a `sig!` prefix. This verifies the authenticity of the
Release Signing Key. Note that the `!` flag after the `sig` tag is important
because it means that the key signature is valid. A `sig-` prefix would
indicate a bad signature and `sig%` would mean that gpg encountered an error
while verifying the signature. It is not necessary to independently verify the
authenticity of the Release Signing Key, since you already verified the
authenticity of the Qubes Master Signing Key. Before proceeding to the next
step, make sure the Release Signing Key is in your keyring:
```
$ gpg2 -k "Qubes OS Release"
@ -266,17 +349,20 @@ pub rsa4096 2017-03-06 [SC]
uid [ full ] Qubes OS Release X Signing Key
```
If you don't see the correct Release Signing Key here, go back and follow the instructions in this section carefully.
If you don't see the correct Release Signing Key here, go back and follow the
instructions in this section carefully.
### 3. Verify your Qubes ISO
Every Qubes ISO is released with a detached PGP signature file, which you can find on the [Downloads](/downloads/) page alongside the ISO.
If the filename of your ISO is `Qubes-RX-x86_64.iso`, then the name of the signature file for that ISO is `Qubes-RX-x86_64.iso.asc`, where `X` is a specific version of Qubes.
The signature filename is always the same as the ISO filename followed by `.asc`.
Every Qubes ISO is released with a detached PGP signature file, which you can
find on the [Downloads](/downloads/) page alongside the ISO. If the filename of
your ISO is `Qubes-RX-x86_64.iso`, then the name of the signature file for that
ISO is `Qubes-RX-x86_64.iso.asc`, where `X` is a specific version of Qubes. The
signature filename is always the same as the ISO filename followed by `.asc`.
Download both the ISO and its signature file.
Put both of them in the same directory, then navigate to that directory.
Now, you can verify the ISO by executing this GPG command in the directory that contains both files:
Download both the ISO and its signature file. Put both of them in the same
directory, then navigate to that directory. Now, you can verify the ISO by
executing this GPG command in the directory that contains both files:
```shell_session
$ gpg2 -v --verify Qubes-RX-x86_64.iso.asc Qubes-RX-x86_64.iso
@ -287,22 +373,28 @@ gpg: Good signature from "Qubes OS Release X Signing Key"
gpg: binary signature, digest algorithm SHA256
```
This is just an example, so the output you receive will not look exactly the same.
What matters is the line that says `Good signature from "Qubes OS Release X Signing Key"`.
This confirms that the signature on the ISO is good.
This is just an example, so the output you receive will not look exactly the
same. What matters is the line that says `Good signature from "Qubes OS Release
X Signing Key"`. This confirms that the signature on the ISO is good.
## How to Verify Qubes ISO Digests
Each Qubes ISO is also accompanied by a plain text file ending in `.DIGESTS`.
This file contains the output of running several different cryptographic hash functions on the ISO in order to obtain alphanumeric outputs known as "digests" or "hash values."
These hash values are provided as an alternative verification method to PGP signatures (though the digest file is itself also PGP-signed --- see below).
If you've already verified the signatures on the ISO directly, then verifying digests is not necessary.
You can find the `.DIGESTS` for your ISO on the [Downloads](/downloads/) page, and you can always find all the digest files for every Qubes ISO in the [Qubes Security Pack](/security/pack/).
This file contains the output of running several different cryptographic hash
functions on the ISO in order to obtain alphanumeric outputs known as "digests"
or "hash values." These hash values are provided as an alternative verification
method to PGP signatures (though the digest file is itself also PGP-signed ---
see below). If you've already verified the signatures on the ISO directly, then
verifying digests is not necessary. You can find the `.DIGESTS` for your ISO on
the [Downloads](/downloads/) page, and you can always find all the digest files
for every Qubes ISO in the [Qubes Security Pack](/security/pack/).
If the filename of your ISO is `Qubes-RX-x86_64.iso`, then the name of the digest file for that ISO is `Qubes-RX-x86_64.iso.DIGESTS`, where `X` is a specific version of Qubes.
The digest filename is always the same as the ISO filename followed by `.DIGESTS`.
Since the digest file is a plain text file, you can open it with any text editor.
Inside, you should find text that looks similar to this:
If the filename of your ISO is `Qubes-RX-x86_64.iso`, then the name of the
digest file for that ISO is `Qubes-RX-x86_64.iso.DIGESTS`, where `X` is a
specific version of Qubes. The digest filename is always the same as the ISO
filename followed by `.DIGESTS`. Since the digest file is a plain text file,
you can open it with any text editor. Inside, you should find text that looks
similar to this:
```
-----BEGIN PGP SIGNED MESSAGE-----
@ -331,9 +423,10 @@ g8JqGYYptgkxjQdX3YAy9VDsCJ/6EkFc2lkQHbgZxjXqyrEMbgeSXtMltZ7cCqw1
-----END PGP SIGNATURE-----
```
Four digests have been computed for this ISO.
The hash functions used, in order from top to bottom, are MD5, SHA1, SHA256, and SHA512.
One way to verify that the ISO you downloaded matches any of these hash values is by using the respective `*sum` programs:
Four digests have been computed for this ISO. The hash functions used, in order
from top to bottom, are MD5, SHA1, SHA256, and SHA512. One way to verify that
the ISO you downloaded matches any of these hash values is by using the
respective `*sum` programs:
```shell_session
$ md5sum -c Qubes-RX-x86_64.iso.DIGESTS
@ -350,13 +443,16 @@ Qubes-RX-x86_64.iso: OK
sha512sum: WARNING: 23 lines are improperly formatted
```
The `OK` response tells us that the hash value for that particular hash function matches.
The program also warns us that there are 23 improperly formatted lines, but this is to be expected.
This is because each file contains lines for several different hash values (as mentioned above), but each `*sum` program verifies only the line for its own hash function.
In addition, there are lines for the PGP signature that the `*sum` programs do not know how to read.
Therefore, it is safe to ignore these warning lines.
The `OK` response tells us that the hash value for that particular hash
function matches. The program also warns us that there are 23 improperly
formatted lines, but this is to be expected. This is because each file contains
lines for several different hash values (as mentioned above), but each `*sum`
program verifies only the line for its own hash function. In addition, there
are lines for the PGP signature that the `*sum` programs do not know how to
read. Therefore, it is safe to ignore these warning lines.
Another way is to use `openssl` to compute each hash value, then compare them to the contents of the digest file.:
Another way is to use `openssl` to compute each hash value, then compare them
to the contents of the digest file.:
```shell_session
$ openssl dgst -md5 Qubes-RX-x86_64.iso
@ -371,11 +467,15 @@ SHA512(Qubes-RX-x86_64.iso)= de1eb2e76bdb48559906f6fe344027ece20658d4a7f04ba00d4
(Notice that the outputs match the values from the digest file.)
However, it is possible that an attacker replaced `Qubes-RX-x86_64.iso` with a malicious ISO, computed the hash values for that malicious ISO, and replaced the values in `Qubes-RX-x86_64.iso.DIGESTS` with his own set of values.
However, it is possible that an attacker replaced `Qubes-RX-x86_64.iso` with a
malicious ISO, computed the hash values for that malicious ISO, and replaced
the values in `Qubes-RX-x86_64.iso.DIGESTS` with his own set of values.
Therefore, we should also verify the authenticity of the listed hash values.
Since `Qubes-RX-x86_64.iso.DIGESTS` is a clearsigned PGP file, we can use GPG to verify it from the command line:
Since `Qubes-RX-x86_64.iso.DIGESTS` is a clearsigned PGP file, we can use GPG
to verify it from the command line:
1. [Get the Qubes Master Signing Key and verify its authenticity](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity)
1. [Get the Qubes Master Signing Key and verify its
authenticity](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity)
2. [Get the Release Signing Key](#2-get-the-release-signing-key)
3. Verify the signature in the digest file:
@ -390,16 +490,22 @@ Since `Qubes-RX-x86_64.iso.DIGESTS` is a clearsigned PGP file, we can use GPG to
gpg: textmode signature, digest algorithm SHA256
```
The signature is good.
If our copy of the `Qubes OS Release X Signing Key` is being validated by the authentic Qubes Master Signing Key (see [above](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity)), we can be confident that these hash values came from the Qubes devs.
The signature is good. If our copy of the `Qubes OS Release X Signing Key` is
being validated by the authentic Qubes Master Signing Key (see
[above](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity)), we
can be confident that these hash values came from the Qubes devs.
## How to Verify Qubes Repos
Whenever you use one of the [Qubes repositories](https://github.com/QubesOS), you should verify the PGP signature in a tag on the latest commit or on the latest commit itself.
(One or both may be present, but only one is required.)
If there is no trusted signed tag or commit on top, any commits after the latest trusted signed tag or commit should **not** be trusted.
If you come across a repo with any unsigned commits, you should not add any of your own signed tags or commits on top of them unless you personally vouch for the trustworthiness of the unsigned commits.
Instead, ask the person who pushed the unsigned commits to sign them.
Whenever you use one of the [Qubes repositories](https://github.com/QubesOS),
you should verify the PGP signature in a tag on the latest commit or on the
latest commit itself. (One or both may be present, but only one is required.)
If there is no trusted signed tag or commit on top, any commits after the
latest trusted signed tag or commit should **not** be trusted. If you come
across a repo with any unsigned commits, you should not add any of your own
signed tags or commits on top of them unless you personally vouch for the
trustworthiness of the unsigned commits. Instead, ask the person who pushed the
unsigned commits to sign them.
To verify a signature on a Git tag:
@ -425,89 +531,118 @@ or
$ git verify-commit <commit ID>
```
You should always perform this verification on a trusted local machine with properly validated keys (which are available in the [Qubes Security Pack](/security/pack/)) rather than relying on a third party, such as GitHub.
While the GitHub interface may claim that a commit has a verified signature from a member of the Qubes team, this is only trustworthy if GitHub has performed the signature check correctly, the account identity is authentic, the user's key has not been replaced by an admin, GitHub's servers have not been compromised, and so on.
Since there's no way for you to be certain that all such conditions hold, you're much better off verifying signatures yourself.
You should always perform this verification on a trusted local machine with
properly validated keys (which are available in the [Qubes Security
Pack](/security/pack/)) rather than relying on a third party, such as GitHub.
While the GitHub interface may claim that a commit has a verified signature
from a member of the Qubes team, this is only trustworthy if GitHub has
performed the signature check correctly, the account identity is authentic, the
user's key has not been replaced by an admin, GitHub's servers have not been
compromised, and so on. Since there's no way for you to be certain that all
such conditions hold, you're much better off verifying signatures yourself.
Also see: [Distrusting the Infrastructure](/faq/#what-does-it-mean-to-distrust-the-infrastructure)
Also see: [Distrusting the
Infrastructure](/faq/#what-does-it-mean-to-distrust-the-infrastructure)
## Troubleshooting FAQ
### Why am I getting "Can't check signature: public key not found"?
You don't have the correct [Release Signing Key](#2-get-the-release-signing-key).
You don't have the correct [Release Signing
Key](#2-get-the-release-signing-key).
### Why am I getting "BAD signature from 'Qubes OS Release X Signing Key'"?
The problem could be one or more of the following:
- You're trying to verify the wrong file(s).
Read this page again carefully.
- You're using the wrong GPG command.
Follow the examples in [Verify your Qubes ISO](#3-verify-your-qubes-iso) carefully.
- The ISO or [signature file](#3-verify-your-qubes-iso) is bad (e.g., incomplete or corrupt download).
Try downloading the signature file again from a different source, then try verifying again.
If you still get the same result, try downloading the ISO again from a different source, then try verifying again.
- You're trying to verify the wrong file(s). Read this page again carefully.
- You're using the wrong GPG command. Follow the examples in [Verify your Qubes
ISO](#3-verify-your-qubes-iso) carefully.
- The ISO or [signature file](#3-verify-your-qubes-iso) is bad (e.g.,
incomplete or corrupt download). Try downloading the signature file again
from a different source, then try verifying again. If you still get the same
result, try downloading the ISO again from a different source, then try
verifying again.
### Why am I getting "bash: gpg2: command not found"?
You don't have `gpg2` installed.
Please install it using the method appropriate for your environment (e.g., via your package manager).
You don't have `gpg2` installed. Please install it using the method appropriate
for your environment (e.g., via your package manager).
### Why am I getting "No such file or directory"?
Your working directory does not contain the required files.
Go back and follow the instructions more carefully, making sure that you put all required files in the same directory *and* navigate to that directory.
Your working directory does not contain the required files. Go back and follow
the instructions more carefully, making sure that you put all required files in
the same directory *and* navigate to that directory.
### Why am I getting "can't open signed data `Qubes-RX-x86_64.iso' / can't hash datafile: file open error"?
### Why am I getting "can't open signed data `Qubes-RX-x86_64.iso' / can't hash
datafile: file open error"?
The correct ISO is not in your working directory.
### Why am I getting "can't open `Qubes-RX-x86_64.iso.asc' / verify signatures failed: file open error"?
### Why am I getting "can't open `Qubes-RX-x86_64.iso.asc' / verify signatures
failed: file open error"?
The correct [signature file](#3-verify-your-qubes-iso) is not in your working directory.
The correct [signature file](#3-verify-your-qubes-iso) is not in your working
directory.
### Why am I getting "no valid OpenPGP data found"?
Either you don't have the correct [signature file](#3-verify-your-qubes-iso), or you inverted the arguments to `gpg2`.
([The signature file goes first.](#3-verify-your-qubes-iso))
Either you don't have the correct [signature file](#3-verify-your-qubes-iso),
or you inverted the arguments to `gpg2`. ([The signature file goes
first.](#3-verify-your-qubes-iso))
### Why am I getting "WARNING: This key is not certified with a trusted signature! There is no indication that the signature belongs to the owner."?
### Why am I getting "WARNING: This key is not certified with a trusted
signature! There is no indication that the signature belongs to the owner."?
Either you don't have the [Qubes Master Signing Key](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity), or you didn't [set its trust level correctly](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity).
Either you don't have the [Qubes Master Signing
Key](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity), or you
didn't [set its trust level
correctly](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity).
### Why am I getting "X signature not checked due to a missing key"?
You don't have the keys that created those signatures in your keyring.
For present purposes, you don't need them as long as you have the [Qubes Master Signing Key](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity) and the [Release Signing Key](#2-get-the-release-signing-key) for your Qubes version.
You don't have the keys that created those signatures in your keyring. For
present purposes, you don't need them as long as you have the [Qubes Master
Signing Key](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity)
and the [Release Signing Key](#2-get-the-release-signing-key) for your Qubes
version.
### Why am I seeing additional signatures on a key with "[User ID not found]" or from a revoked key?
### Why am I seeing additional signatures on a key with "[User ID not found]"
or from a revoked key?
This is just a basic part of how OpenPGP works.
Anyone can sign anyone else's public key and upload the signed public key to keyservers.
Everyone is also free to revoke their own keys at any time (assuming they possess or can create a revocation certificate).
This has no impact on verifying Qubes ISOs, code, or keys.
This is just a basic part of how OpenPGP works. Anyone can sign anyone else's
public key and upload the signed public key to keyservers. Everyone is also
free to revoke their own keys at any time (assuming they possess or can create
a revocation certificate). This has no impact on verifying Qubes ISOs, code, or
keys.
### Why am I getting "verify signatures failed: unexpected data"?
You're not verifying against the correct [signature file](#3-verify-your-qubes-iso).
You're not verifying against the correct [signature
file](#3-verify-your-qubes-iso).
### Why am I getting "not a detached signature"?
You're not verifying against the correct [signature file](#3-verify-your-qubes-iso).
You're not verifying against the correct [signature
file](#3-verify-your-qubes-iso).
### Why am I getting "CRC error; [...] no signature found [...]"?
You're not verifying against the correct [signature file](#3-verify-your-qubes-iso), or the signature file has been modified.
Try downloading it again or from a different source.
You're not verifying against the correct [signature
file](#3-verify-your-qubes-iso), or the signature file has been modified. Try
downloading it again or from a different source.
### Do I have to verify the ISO against both the [signature file](#3-verify-your-qubes-iso) and the [digest file](#how-to-verify-qubes-iso-digests)?
### Do I have to verify the ISO against both the [signature
file](#3-verify-your-qubes-iso) and the [digest
file](#how-to-verify-qubes-iso-digests)?
No, either method is sufficient by itself.
### Why am I getting "no properly formatted X checksum lines found"?
You're not checking the correct [digest file](#how-to-verify-qubes-iso-digests).
You're not checking the correct [digest
file](#how-to-verify-qubes-iso-digests).
### Why am I getting "WARNING: X lines are improperly formatted"?
@ -519,9 +654,14 @@ The correct ISO is not in your working directory.
### I have another problem that isn't mentioned here.
Carefully read this page again to be certain that you didn't skip any steps.
In particular, make sure you have the [Qubes Master Signing Key](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity), the [Release Signing Key](#2-get-the-release-signing-key), *and* the [signature file](#3-verify-your-qubes-iso) and/or [digest file](#how-to-verify-qubes-iso-digests) all for the *correct* Qubes OS version.
If your question is about GPG, please see the [GPG documentation](https://www.gnupg.org/documentation/).
Still have question?
Please see [Help, Support, Mailing Lists, and Forum](/support/) for places where you can ask!
Carefully read this page again to be certain that you didn't skip any steps. In
particular, make sure you have the [Qubes Master Signing
Key](#1-get-the-qubes-master-signing-key-and-verify-its-authenticity), the
[Release Signing Key](#2-get-the-release-signing-key), *and* the [signature
file](#3-verify-your-qubes-iso) and/or [digest
file](#how-to-verify-qubes-iso-digests) all for the *correct* Qubes OS version.
If your question is about GPG, please see the [GPG
documentation](https://www.gnupg.org/documentation/). Still have question?
Please see [Help, Support, Mailing Lists, and Forum](/support/) for places
where you can ask!

41
project-security/xsa.md
View file

@ -6,25 +6,38 @@ ref: 214
title: Xen Security Advisory (XSA) Tracker
---
This tracker shows whether Qubes OS is affected by any given [Xen Security
Advisory (XSA)](https://xenbits.xen.org/xsa/). Shortly after a new XSA is
published, we will add a new row to this tracker. Whenever Qubes is
significantly affected by an XSA, a [Qubes Security Bulletin
(QSB)](/security/bulletins/) is published, and a link to that QSB is added to
the row for the associated XSA.
This tracker shows whether Qubes OS is affected by any given [Xen Security Advisory (XSA)](https://xenbits.xen.org/xsa/).
Shortly after a new XSA is published, we will add a new row to this tracker.
Whenever Qubes is significantly affected by an XSA, a [Qubes Security Bulletin (QSB)](/security/bulletins/) is published, and a link to that QSB is added to the row for the associated XSA.
Under the "Is Qubes Affected?" column, there are two possible values: **Yes** or **No**.
Under the "Is Qubes Affected?" column, there are two possible values: **Yes**
or **No**.
* **Yes** means that the *security* of Qubes OS *is* affected.
* **No** means that the *security* of Qubes OS is *not* affected.
Important Notes
---------------
## Important Notes
* For the purpose of this tracker, we do *not* classify mere [denial-of-service (DoS) attacks](https://en.wikipedia.org/wiki/Denial-of-service_attack) as affecting the *security* of Qubes OS.
Therefore, if an XSA pertains *only* to DoS attacks against Qubes, the value in the "Is Qubes Affected?" column will be **No**.
* For simplicity, we use the present tense ("is affected") throughout this page, but this does **not** necessarily mean that up-to-date Qubes installations are *currently* affected by any particular XSA.
In fact, it is extremely unlikely that any up-to-date Qubes installations are vulnerable to any XSAs on this page, since patches are almost always published concurrently with QSBs.
Please read the QSB (if any) for each XSA for patching details.
* Embargoed XSAs are excluded from this tracker until they are publicly released, since the [Xen Security Policy](https://www.xenproject.org/security-policy.html) does not permit us to state whether Qubes is affected prior to the embargo date.
* Unused and withdrawn XSA numbers are included in the tracker for the sake of completeness, but they are excluded from the [Statistics](#statistics) section for the sake of accuracy.
* For the purpose of this tracker, we do *not* classify mere [denial-of-service
(DoS) attacks](https://en.wikipedia.org/wiki/Denial-of-service_attack) as
affecting the *security* of Qubes OS. Therefore, if an XSA pertains *only* to
DoS attacks against Qubes, the value in the "Is Qubes Affected?" column will
be **No**.
* For simplicity, we use the present tense ("is affected") throughout this
page, but this does **not** necessarily mean that up-to-date Qubes
installations are *currently* affected by any particular XSA. In fact, it is
extremely unlikely that any up-to-date Qubes installations are vulnerable to
any XSAs on this page, since patches are almost always published concurrently
with QSBs. Please read the QSB (if any) for each XSA for patching details.
* Embargoed XSAs are excluded from this tracker until they are publicly
released, since the [Xen Security
Policy](https://www.xenproject.org/security-policy.html) does not permit us
to state whether Qubes is affected prior to the embargo date.
* Unused and withdrawn XSA numbers are included in the tracker for the sake of
completeness, but they are excluded from the [Statistics](#statistics)
section for the sake of accuracy.
* All dates are in UTC.